a0b651b04793579490c76c8db359a2bbefdd3b88b147698d594d7802c23330b1

Analysis

Target
8bcb6d7f4968e690a79bcdf9ac24e65a.dll
Size 780KB
Sample220125-ld769sdbb7
SHA256 a0b651b04793579490c76c8db359a2bbefdd3b88b147698d594d7802c23330b1
MD5 8bcb6d7f4968e690a79bcdf9ac24e65a
SHA1 81ff008b4c66eb4fb4a7db5fef037be2ed17a0df
SHA512 c4b92252d43e1014d2ac88775908fc75a9230bf694e3231d5cca293ce8e855ff2294300fe4622f787dd55ec6eded87fa43b9abb06159cd4e67b6d64470b23de4
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1972 wrote to memory of 1484	1972	regsvr32.exe	27
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28
PID 1484 wrote to memory of 1624	1484	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8bcb6d7f4968e690a79bcdf9ac24e65a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8bcb6d7f4968e690a79bcdf9ac24e65a.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8bcb6d7f4968e690a79bcdf9ac24e65a.dll",DllRegisterServer
    3⤵
    PID:1624

memory/1484-56-0x0000000074B21000-0x0000000074B23000-memory.dmp

Download

memory/1972-55-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download